Detection Engineer: Telemetry & Adversary Coverage

Vodafone; Lisboa; Hybrid; EUR 70,000 - 120,000; Full time

Benefits offered by this job

Hybrid work model

Mobile phone & plan

Employee discounts

Job summary

Vodafone is seeking a Detection Engineer for the Cyber Defence Operations Centre to own end-to-end telemetry strategy and ensure robust detection across Vodafone environments.

You will align telemetry with MITRE ATT&CK, support threat modelling, and collaborate with CSOC, Cyber Prevent and Local Markets to deliver data-driven security outcomes. This role emphasizes logging quality, data enrichment, and threat-led validation.

Qualifications

• Bachelor/Master's Degree in related field.
• 4+ years in detection content, threat intelligence, hunting or offensive security.
• Expert with MITRE ATT&CK (enterprise/cloud) & ATT&CK Navigator.
• Hands-on with KQL/SPL/Sigma/YARA, Microsoft Defender, Splunk, QRadar SOAR; scripting (Python/PowerShell).
• Adversary emulation/simulation certifications (OSCP/OSEP, GXPN/GPEN) or equivalent.
• Fluency in English.

Responsibilities

• Own the threat-led strategy for onboarding and prioritising security telemetry.
• Define logging requirements for endpoint, identity, network, cloud, and SaaS.
• Determine which log sources are security-critical versus informational.
• Define and govern acceptance criteria for telemetry consumed by CSOC.
• Maintain ATT&CK-aligned coverage views mapping telemetry to adversary techniques.
• Produce and maintain artefacts (dashboards, runbooks) showing logging effectiveness.

Skills

MITRE ATT&CK

Threat modelling

KQL

SPL

YARA

Python

PowerShell

Threat intelligence

Detection engineering

Adversary emulation

Education

Bachelor/Master's Degree in related field

Tools

Microsoft Defender

Splunk

QRadar SOAR

Job description

Vodafone is seeking a Detection Engineer for the Cyber Defence Operations Centre to own end-to-end telemetry strategy and ensure robust detection across Vodafone environments.

You will align telemetry with MITRE ATT&CK, support threat modelling, and collaborate with CSOC, Cyber Prevent and Local Markets to deliver data-driven security outcomes. This role emphasizes logging quality, data enrichment, and threat-led validation.